Does an NDA let a buyer access patient records?

Short answer

Start with the buyer’s decision, not a request to open every folder. Ask what fact needs verification and what information could answer it. A review of revenue trends differs from a clinical review or a test of historical billing. Identify the record holder, intended user and task before preparing the file.

The NDA definition explains the contract’s commercial role. The records-custody guide covers storage and handoff. This answer focuses on a narrower issue: an approved review can change as the buyer adds people, details or new uses.

Longer answer

HIPAA’s definition of health care operations includes certain sales, transfers, mergers and related diligence. It concerns a covered entity and another covered entity, or an entity that will become covered through that activity. Section 164.506 also addresses permitted uses and disclosures subject to its other requirements. Those provisions do not give every interested buyer unrestricted chart access. (Source: GPO Title 45, sections 164.501 and 164.506; 14 MB XML download)

The responsible privacy adviser must assess the actual transaction and information. Other laws and special record categories may matter. A nonmedical service business is not automatically a HIPAA covered entity merely because it serves older adults. Equally, records outside HIPAA may still have legal or contractual protections.

HHS’s minimum-necessary guidance describes reasonable limits for covered uses, requests and disclosures, with express exceptions. It also distinguishes routine protocols from individual review of non-routine requests. The team should apply the actual standard rather than assume that every request follows one rule. (Source: HHS minimum necessary)

For a qualifying business associate relationship, HHS describes written assurances and restrictions on permitted uses. Status depends on the functions and services involved, including relevant subcontractors. An investor, clinical consultant and storage provider should not be treated as interchangeable merely because each signed something confidential. (Source: HHS business associates)

What it depends on

Record the original request in plain language. Name the question, approved recipients, information level, purpose and review method. Keep the responsible person’s decision with that request. If the buyer later asks for more, compare the new request with those facts before expanding access.

A new recipient can create a new issue even if the file is unchanged. A new use can do the same. For example, information prepared for a specific diligence task should not be treated as available for a buyer’s unrelated product development. The relevant agreements and law need their own assessment of that use.

The contents also matter. HHS explains two HIPAA de-identification methods: Expert Determination and Safe Harbor. Names are only part of the issue; other details or combinations may identify someone. Do not assume a coded file is suitable for broad release. (Source: HHS de-identification)

Keep the business question visible through the diligence checklist. A quality-of-earnings review may need evidence about reported revenue, but the report should explain what was checked and what access limits remain. A strong financial label does not establish lawful chart access.

Example

Assume a fictional seller’s team has approved a limited summary for a defined financial review. No patient-level access has been approved. The buyer then submits the three requests below. The example identifies changes to review; it does not decide that any proposed disclosure is lawful or unlawful.

Each request is different even though the NDA has not changed. The team should record each difference and route it to the proper reviewer. It may approve an appropriately supported method, ask for a narrower request or leave the question open. The fictional summary approval does not determine the next result.

The data-room guide explains why access settings should match that decision. Do not create a general login while a request is unresolved and expect the recipient to infer which records are off limits. Keep the decision and actual permissions aligned.

The NDA access-register guide develops the next step: compare the exact export and active users with the approved request. It also separates closing a room account from resolving copies retained outside the room.

What to do next

Use the seller document guide to identify the available evidence and the confidential sale guide to coordinate requests. Bring the exact parties, purpose and proposed fields to the privacy adviser before changing access.

Record the result, its limits and the conditions that would require another review. At handoff, the first 90 days guide helps separate buyer diligence from the authorized operator’s ongoing work. A transaction milestone does not turn every earlier request into permission.